Password reset form should not leak information

[anonymous]

The provided password reset form leaks information about enrolled users by providing information as to whether an email is enrolled. This is obviously untenable for any site with even moderate confidentiality requirements.

Correct behavior is to display the same result regardless of whether an email is found in the database.

[anonymous]

I think this is fixed in a pull request now: ​https://github.com/django/django/pull/703

[Carl Meyer]

I know this has been debated in the past, but I agree that the default behavior should be safe with respect to both security and confidentiality requirements. If some people want a "friendlier" password reset and don't care about these requirements, we can document an easy path to providing different responses depending whether the email address is enrolled.

[Horst Gutmann]

@carljm so you basically want to have the default behaviour to be the "secure" approach and perhaps offer a setting (either globally or on a per-form level) to switch to a version that exposes the existence of a user's email?

[Aymeric Augustin]

We don't need a setting for this. Django should follow the best practice of not leaking information.

Developers can adjust this (depending on their requirements) through subclassing. This could be documented.

[Horst Gutmann]

​https://github.com/django/django/pull/754 contains a new version of the pull request. It is no based on the one by Kenn Knowles and goes a bit further by also updating the documentation and templates.

[Aymeric Augustin <aymeric.augustin@…>]

In 2f4a4703e1931fadf5ed81387b26cf84caf5bef9:

Fixed #19758 -- Avoided leaking email existence through the password reset form.

[Carl Meyer]

(Aymeric is correct, I didn't intend to suggest a setting, just that we could document the subclassing approach.)

[Claude Paroz <claude@…>]

In 5f52590368063fc8284e23be492d83ba751f66bf:

Fixed #21291 -- Ensured inactive users cannot reset their passwords

Thanks kz26 for the report and the suggested fix. Refs #19758.

[Claude Paroz <claude@…>]

In 0c850e28858016b5890ae83a6ec6880614b306a2:

[1.6.x] Fixed #21291 -- Ensured inactive users cannot reset their passwords

Thanks kz26 for the report and the suggested fix. Refs #19758.

Backport of 5f5259036 from master.